CVE-2026-14366

The Silicon Labs SiWx917 WiFi driver's transmit callback siwx91xsend in drivers/wifi/siwx91x/siwx91xwifi.c frees a network packet it does not own. In the Zephyr TX path the netpkt is owned by the L2/networking stack; the driver only borrows it to copy the frame bytes into a local netbuf. Before t...

CVE-2026-14366 SiWx91x WiFi driver double-unref / use-after-free of caller-owned TX net_pkt

The Silicon Labs SiWx917 WiFi driver's transmit callback siwx91xsend in drivers/wifi/siwx91x/siwx91xwifi.c frees a network packet it does not own. In the Zephyr TX path the netpkt is owned by the L2/networking stack; the driver only borrows it to copy the frame bytes into a local netbuf. Before t...

PT-2026-83897

Name of the Vulnerable Software and Affected Versions Silicon Labs SiWx917 WiFi driver affected versions not specified Description The transmit callback function siwx91x send in the WiFi driver incorrectly releases a network packet owned by the L2 networking stack. This occurs when the CONFIG WIF...

CVE-2026-65936

A malformed Bluetooth connection request message can cause the RS9116W/SiWx917 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below...

CVE-2026-65935

Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the temporary key value. See vulnerability B-E3 in the related paper below...

CVE-2026-16101

Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below...

CVE-2026-65936

A malformed Bluetooth connection request message can cause the RS9116W/SiWx917 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below...

EUVD-2026-58085

A malformed Bluetooth connection request message can cause the RS9116W/SiWx917 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below...

CVE-2026-65936

CVE-2026-65936 affects the RS9116W/SiWx917 Bluetooth stack. The root cause is a malformed Bluetooth connection request message with an increased length field, which can cause a memory leak and potential leakage of sensitive information. The record from CVELIST explicitly frames it as a malformed ...

CVE-2026-65936 RS9116W/SiWx917 malformed packet with increased length field causes memory leak

A malformed Bluetooth connection request message can cause the RS9116W/SiWx917 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below...

CVE-2026-65936 RS9116W/SiWx917 malformed packet with increased length field causes memory leak

A malformed Bluetooth connection request message can cause the RS9116W/SiWx917 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below...

EUVD-2026-58082

Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the temporary key value. See vulnerability B-E3 in the related paper below...

CVE-2026-65935

CVE-2026-65935 describes a bypass of the Bluetooth LE legacy passkey entry by manipulating the temporary key value, affecting the RS9116W and SiWx917 hardware. The root cause is not fully disclosed in the provided notes beyond the bypass mechanism; the vulnerability impacts the pairing process, p...

CVE-2026-65935 Bypassing passkey entry in legacy pairing

Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the temporary key value. See vulnerability B-E3 in the related paper below...

CVE-2026-65935 Bypassing passkey entry in legacy pairing

Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the temporary key value. See vulnerability B-E3 in the related paper below...

CVE-2026-16101 forced re-pairing with already bonded device

Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below...

EUVD-2026-57925

Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below...

CVE-2026-16101

The CVE concerns Silicon Labs RS9116W and SiWx917 wireless components. A spoofed, already bonded device can force re-pairing with a rogue device, effectively re-bonding security associations and potentially granting adjacent attackers high-impact access. The vulnerability stems from improper bond...

CVE-2026-6924

A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. As such, all random numbers generated in the Matter code use the same stream of numbers. This vulnerability was discovered after the impacted repository was already deprecated...

CVE-2026-6924

CVE-2026-6924 describes a weak entropy initialization in SiWx917 TinyCrypt used by Silicon Labs Matter, causing the DRBG to seed from a predictable source. As a result, all random numbers in the Matter code may derive from the same stream, reducing unpredictability. The CVSS vector in the documen...